|   103 |   int *ptr = (int *)malloc (sizeof (int)); | 
 |                     ^~~~~~~~~~~~~~~~~~~~~ | 
 |                     | | 
 |                     (1) allocated here | 
|   104 |   *ptr = 42; /* { dg-warning "dereference of possibly-NULL 'ptr'" } */ | 
 |   ~~~~~~~~~           | 
 |        | | 
 |        (2) assuming ‘ptr’ is non-NULL | 
|   105 |   if (x) | 
 |      ~                | 
 |      | | 
 |      (3) following ‘true’ branch (when ‘x != 0’)... | 
|   106 |     free (ptr); | 
 |     ~~~~~~~~~~        | 
 |     | | 
 |     (4) ...to here | 
 |     (5) freed here | 
|   107 |  | 
|   108 |   *ptr = 19; /* { dg-warning "use after 'free' of 'ptr'" } */ | 
 |   ~~~~~~~~~           | 
 |        | | 
 |        (6) use after ‘free’ of ‘ptr’; freed at (5) |